As long as a user is not activated, he cannot login, as intended. However, he can reset his password or try to login without a meaningful error message.